Practical 11 — System Hacking using auditpol

Aim
View and configure Windows audit policy, then inspect related event logs.

COMMANDS
```cmd
auditpol /?
auditpol /get /category:*
auditpol /set /subcategory:"Process Creation" /success:enable
```

STEPS
1. Open CMD as Administrator.
2. Use `auditpol /?` to review syntax.
3. Check current audit categories with `/get`.
4. Enable success auditing for Process Creation as shown.
5. Verify the policy and inspect relevant records in Event Viewer.

Key point: Audit policy controls which security events Windows records. Administrative privileges may be required.
